login.live.com.weblive.email

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 185.125.230.77, located in Russian Federation and belongs to AS-MAROSNET Moscow, Russia, RU. The main domain is login.live.com.weblive.email.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 26th 2019. Valid for: 3 months.

This is the only time login.live.com.weblive.email was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	185.125.230.77 185.125.230.77	48666 (AS-MAROSN...) (AS-MAROSNET Moscow)
1	2606:4700:30:... 2606:4700:30::681b:8f9c	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	51.159.31.16 51.159.31.16	12876 (Online SAS) (Online SAS)
6	3

1 185.125.230.77 (Russian Federation)

ASN48666 (AS-MAROSNET Moscow, Russia, RU)

login.live.com.weblive.email	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681b:8f9c (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

rawgit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 51.159.31.16 (Paris, France)

ASN12876 (Online SAS, FR)
PTR: 51b4abe6-3f53-4669-a358-9b2a180e2d1b.fr-par-2.baremetal.scw.cloud

s7.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	postimg.cc s7.postimg.cc	120 KB
1	rawgit.com rawgit.com	15 KB
1	weblive.email login.live.com.weblive.email	2 KB
6	3

	Domain	Requested by
4	s7.postimg.cc	login.live.com.weblive.email
1	rawgit.com	login.live.com.weblive.email
1	login.live.com.weblive.email
6	3

This site contains links to these domains. Also see Links.

Domain
www.outlook.com

Subject Issuer	Validity	Valid
login.live.com.weblive.email Let's Encrypt Authority X3	`2019-10-26` - `2020-01-24`	3 months	crt.sh
sni48800.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-10-15` - `2020-04-22`	6 months	crt.sh
postimg.cc Let's Encrypt Authority X3	`2019-09-06` - `2019-12-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://login.live.com.weblive.email/
Frame ID: 45DA29FCE71F5630A198B2D12AEBC6FA
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

137 kB
Transfer

209 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.outlook.com/
Title: Forgot my password

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
login.live.com.weblive.email/ 5 KB
2 KB 301ms
45ms Document
text/html 185.125.230.77
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: https://login.live.com.weblive.email/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.125.230.77 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache/2.4.34 (Ubuntu) /
Resource Hash: 15efbc70c9ab376c8e21cf67b19664ad21dd79c660965b5f9a5ab08580ac4a92

Request headers

Host: login.live.com.weblive.email
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

Date: Sat, 26 Oct 2019 12:23:57 GMT
Server: Apache/2.4.34 (Ubuntu)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1555
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 Converged1033.css
rawgit.com/Tarsotelvab/Hotmail.github.io/master/ 85 KB
15 KB 250ms
202ms Stylesheet
text/css 2606:4700:30::681b:8f9c
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://rawgit.com/Tarsotelvab/Hotmail.github.io/master/Converged1033.css

Requested by

Host: login.live.com.weblive.email
URL: https://login.live.com.weblive.email/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:30::681b:8f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d43049cccf6f28ee913aac1cfd163b4bb24e9aacfcbbbdc43915b6ef48dffa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://login.live.com.weblive.email/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 26 Oct 2019 12:23:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
vary: Accept-Encoding
rawgit-cache-status: MISS
x-robots-tag: none
content-type: text/css;charset=utf-8
server: cloudflare
etag: W/"d5eaf7c555b1c4fda95f9046b3c4243e9a67aca12eff2f5cf2bb90c459cad1a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; preload
sunset: Tue, 01 Oct 2019 00:00:00 GMT
access-control-allow-origin: *
cache-control: max-age=3600, s-maxage=300
cf-ray: 52bc678a3fa6599a-VIE
link: <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."

GET
H2 200 microsoft_logo.png
s7.postimg.cc/5fiq37hyz/ 1 KB
1 KB 236ms
188ms Image
image/png 51.159.31.16
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/5fiq37hyz/microsoft_logo.png
Requested by: Host: login.live.com.weblive.email
URL: https://login.live.com.weblive.email/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.31.16 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: 51b4abe6-3f53-4669-a358-9b2a180e2d1b.fr-par-2.baremetal.scw.cloud
Software: nginx /
Resource Hash: 338d865cfc45ca4df2a2738c8ea139f16c22c3d2928e81044e9bb229a91af28d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://login.live.com.weblive.email/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 26 Oct 2019 12:23:57 GMT
last-modified: Sun, 15 Apr 2018 09:49:05 GMT
server: nginx
status: 200
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 1158
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 image.png
s7.postimg.cc/ddd54lfqz/ 1 KB
1 KB 240ms
193ms Image
image/png 51.159.31.16
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/ddd54lfqz/image.png
Requested by: Host: login.live.com.weblive.email
URL: https://login.live.com.weblive.email/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.31.16 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: 51b4abe6-3f53-4669-a358-9b2a180e2d1b.fr-par-2.baremetal.scw.cloud
Software: nginx /
Resource Hash: f60030d516d91c4ca92ff5e5af94449f6be06cc8d356a0f15e3c8d8fabe14b4f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://login.live.com.weblive.email/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 26 Oct 2019 12:23:57 GMT
last-modified: Sun, 15 Apr 2018 10:17:55 GMT
server: nginx
status: 200
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 1027
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 0-small.jpg
s7.postimg.cc/gk7oo4sgb/ 3 KB
3 KB 182ms
181ms Image
image/jpeg 51.159.31.16
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/gk7oo4sgb/0-small.jpg
Requested by: Host: login.live.com.weblive.email
URL: https://login.live.com.weblive.email/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.31.16 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: 51b4abe6-3f53-4669-a358-9b2a180e2d1b.fr-par-2.baremetal.scw.cloud
Software: nginx /
Resource Hash: f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://login.live.com.weblive.email/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 26 Oct 2019 12:23:58 GMT
last-modified: Sun, 15 Apr 2018 10:16:26 GMT
server: nginx
status: 200
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 3006
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 image.jpg
s7.postimg.cc/l795ceisb/ 114 KB
114 KB 291ms
291ms Image
image/jpeg 51.159.31.16
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/l795ceisb/image.jpg
Requested by: Host: login.live.com.weblive.email
URL: https://login.live.com.weblive.email/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.31.16 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: 51b4abe6-3f53-4669-a358-9b2a180e2d1b.fr-par-2.baremetal.scw.cloud
Software: nginx /
Resource Hash: e78bcff5e11b03acf87f7aeb7ebde0f6eecc5e2b59c26581961427788b1c1b2b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://login.live.com.weblive.email/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 26 Oct 2019 12:23:58 GMT
last-modified: Sun, 15 Apr 2018 08:51:46 GMT
server: nginx
status: 200
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 116692
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.live.com.weblive.email
rawgit.com
s7.postimg.cc
185.125.230.77
2606:4700:30::681b:8f9c
51.159.31.16
15efbc70c9ab376c8e21cf67b19664ad21dd79c660965b5f9a5ab08580ac4a92
338d865cfc45ca4df2a2738c8ea139f16c22c3d2928e81044e9bb229a91af28d
3d43049cccf6f28ee913aac1cfd163b4bb24e9aacfcbbbdc43915b6ef48dffa2
e78bcff5e11b03acf87f7aeb7ebde0f6eecc5e2b59c26581961427788b1c1b2b
f60030d516d91c4ca92ff5e5af94449f6be06cc8d356a0f15e3c8d8fabe14b4f
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

login.live.com.weblive.email Open in urlscan Pro 185.125.230.77 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

137 kBTransfer

209 kBSize

0 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

login.live.com.weblive.email Open in urlscan Pro
185.125.230.77 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

137 kB
Transfer

209 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!